Source: www.databreachtoday.com – Author:
Attack Surface Management , Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime
Prajeet Nair (@prajeetspeaks) • December 13, 2024
An Iranian state hacking group is using custom malware that researchers liken to a “cyber weapon” to compromise IoT and OT infrastructure in Israel and the United States.
See Also: 2024 Threat Hunting Report: Insights to Outsmart Modern Adversaries
Researchers from New York-based Claroty said Friday that an attack wave from an Islamic Revolutionary Guard Corps-affiliated group going by the persona “CyberAv3ngers” swept up fuel management systems made by U.S.-based firm Gilbarco Veeder-Root. Claroty dubs the malware “IOControl.”
Tensions between Israel and Iran have developed into a proxy conflict taking place across Lebanon, Syria and the Gaza Strip that began with the Oct. 7, 2023 incursion of Iranian ally Hamas into Israel. One wave of attacks against Gilbarco Veeder-Root-branded “Orpak” fuel management devices ran from October 2023 through January. Malware samples collected from VirusTotal indicate the group initiated a second campaign around July or August and also includes Gilbarco Veeder-Root systems marketed as “Gasboy.”
The same Iranian threat actor in late 2023 hacked programmable logic controllers manufactured by an Israel firm in order to display anti-Israeli messages. Around the same time of the PLC hacking, CyberAv3ngers on Telegram claimed it attacked 200 gas stations in Israel and the United States by compromising Orpak systems.
Hacking group Gonjeshke Darande, suspected of affiliation with the Israeli government, took responsibility in December 2023 for launching a cyberattack against Iranian fuel pumps (See: Iran Hit by Major Cyberattack Targeting Nation’s Fuel Supply).
IOControl “is essentially custom built for IoT devices but also has a direct impact on OT, such as the fuel pumps that are heavily used in gas stations,” Claroty wrote. Fuel management systems are systems on gas pumps that process payment cards, control pumps and nozzles and perform other functions such as printing receipts.
“Based on what we currently know, some of the attacks appear to have originated from brute-forcing internet-exposed SSH services on the IoT/OT devices,” said Sharon Brizinov, Claroty director of research in an email to Information Security Media Group. “After gaining initial access, the attackers deployed the IOControl malware. Consequently, we advise asset owners to restrict access to these devices by placing them behind a firewall or NAT.”
Systems administrators should further disable SSH access, or at least enforce strong passwords for access, Brizinov said.
The U.S. Department of the Treasury imposed sanctions on six officials from the Islamic Revolutionary Guard Corps Cyber Electronic Command in February, linking them to CyberAv3ngers. The Department of State is offering $10 million for information leading to the identification or capture of individuals involved CyberAv3ngers attacks.
Researchers obtained a sample of IOControl extracted from a Gasboy fuel control system. One concerning feature of IOControl is its persistence mechanism. The malware installs a backdoor on compromised systems, ensuring that it remains active even after a device reboot. “The backdoor is located in /etc/rc3.d/S93InitSystemd.sh,” Claroty wrote.
The malware communicates with command and control infrastructure using MQTT, a lightweight messaging protocol designed for devices with limited network bandwidth, making it ideal for IoT applications.
The malware uses the MQTT protocol over port 8883, which is typically secured, adding an extra layer of stealth to its operation. The malware evades detection by using DNS over HTTPS to obfuscate its C2 domain communications.
Creators of the malware have used it to attack a variety devices made by multiple manufacturers, including D-Link, Hikvision, Baicells, Red Lion, Phoenix Contact, Teltonika and Unitronics.
Original Post url: https://www.databreachtoday.com/researchers-iranian-custom-malware-targets-fuel-systems-a-27058
Category & Tags: –
Views: 0
